Re: [SECURITY] nstree: listns() ns_id=U64_MAX pagination cursor wraparound

[Jan Kara]

On Tue 10-11-26 20:47:51, n3rd wrote:
> I am reporting a security bug in the Linux kernel.
> 
> 1. Affected kernel versions
> Linux v7.3-rc7 (mainline, built and tested as 7.3.0-rc7 on a KASAN
> kernel) is affected and was reproduced twice. For the other versions I
> rely on a static comparison rather than on my own runs: kernel/nstree.c
> has the git blob hash 831f279d174a32c95953189aa7d9d3dd0ff11a38 in v7.2.9,
> v7.3-rc6 and v7.3-rc7, and the three affected statements sit at the same
> lines in all three. v7.2.9 and later v7.2 stable releases, and v7.3-rc6,
> are therefore affected as well, but I did not boot those kernels myself.
> Earlier versions were not tested or bisected. There is no upstream fix as
> of v7.3-rc7.

Please always verify your reports against linux-next before wasting
everybody's time. This one was fixed by 2a1887000e2d ("listns: don't wrap
around with a U64_MAX cursor").

								Honza
-- 
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR